Comment by paypalcust83 | Hacker News Reader

Comment by paypalcust83 | Hacker News Reader

Be very careful with licensing.

VMware early-on had licensing code that disabled a customer's app and cost them a lot of money. Licensing of enterprise features is best to have a nag screen and disable some future actions rather than drop a ban-hammer. They were forced to strip out that code and ended up with weak enforcement of licensing.

Telemetry and online verification are unacceptable to some customers of on-prem software. To them, it should work even if the vendor goes out of business.

Volume license keys should exist for large-scale deployment of on-prem software in concert with open sources surveillance (search engines and warez sites) of license keys and software to prevent abuse. Even then, it's better to reissue volume license keys to customers because DLP of an external entity is an essentially impossible task.. at least they will know there's a problem and may work to police themselves.

Stopping all piracy is undesirable because persons who cannot afford it but are in/direct decision-makers have the ability to sabotage sales and/or acquire an unfavorable impression of the brand. Piracy and leaks are indirectly helpful to overall sales and marketing. Keep it down to a dull roar, because some people and some factions of industries are more-or-less like Fight Club. If something is used commercially at-scale from a small vendor, support their survival with licensing fees... don't be Best Buy.

Nothing is worse than the licensing of Archicad.

Downloaded the trial? Great! Enjoy.

If you don’t read the license terms, then you don’t find out that anything created or edited with the trial version is encrypted to the installation. I found out about this by searching the error code I was faced with after the fact.

I lost weeks of work, couldn’t even buy a license key to unlock it as I had reinstalled the software (within the trial period).

Needless to say, Graphisoft will never see a penny out of me.

Thanks for your valuable comment!

I thought telemetry and online verification will be just an option. If some app vendor doesn't want their users to force such thing, they will not use it. However, maybe, for some specific users, it may make sense.

Np. I forgot to mention that on-prem software usually optimizes for either proprietariness or COSS. If the former, it maybe worthwhile to employ multiple obfuscation and integrity checks in order to protect IP.

A VMware acquisition product I was involved in used a lot of dynamic language code and it seemed like a great idea for rapid development, but not necessarily for maintenance, sustainment, and IP protection. (They were still acquihired for eight figures nonetheless.)

If I were to be involved in a future enterprise startup intended for FNAC and/or acquihire, I would look at Crystal, Go, Haskell, OCaml, or Rust rather than the usual dynamic language suspects.

> If I were to be involved in a future enterprise startup intended for FNAC and/or acquihire, I would look at Crystal, Go, Haskell, OCaml, or Rust rather than the usual dynamic language suspects.

Thank you for your insight again. I tried to Google FNAC but I didn't have luck. What does it mean?

> FNAC

In this case, "feature, not a company" (I believe).

> I would look at Crystal, Go, Haskell, OCaml, or Rust rather than the usual dynamic language suspects

Or, you know, go full obfuscation: minify your JavaScript before your ship it!

Back in the day, we used Mozilla's Rhino as a JS engine -- if you're not familiar, it was a JS engine that compiled JS to Java byte code, literally putting the Java in JavaScript (or vice versa?). IIRC every function became a Java class, which made for some serious weirdness when it came to debugging garbage collection (new anonymous function? more permgen usage!)...

We shipped a .jar for on-prem installation. Needless to say, anyone who tried to decompile got a hilariously confusing set of Java code. :)

>Licensing of enterprise features is best to have a nag screen

At one of my past startups, I was asked to implement a licensing scheme, and we went with a hybrid approach. Nothing that one of our customer's customers would see was initially affected, but our customers would see a nag with a 30 day countdown. After 30 days their customers would also see the nag, and lockdown would occur after 60 days. That gave everyone plenty of time to resolve any license issues and avoided any "whoops, we broke your stuff at a critical time" nightmares.

> open sources surveillance (search engines and warez sites)

That's the first time I've heard "open source" used to refer to a warez site.

Is this overloading of the term being seeded by someone in order to, in a roundabout way, discredit the open source movement? A few years ago there would have been an obvious suspect for such FUD, but they seem to have embraced open source these days, so that wouldn't make sense.

Weird.

Open Source surveillance means "looking for/at stuff that is openly published" - e.g. looking on warez sites for keys being shared..

I'm pretty sure the term has been in use since the 1940s

Ah, I guess so. Thanks. Perhaps my tinfoil hat got in the way of seeing the context.

It is called some other terms depending on country, so it can be non-trivial to grok when you first encounter it.

(For years, I knew it as "White Intelligence")

"Open source" is a term long-used in intelligence/police circles that refers to the means of obtaining information, e.g. a newspaper article is an open source.

As most intelligence-related terms do, it has inevitably spread out to the wider audience of wannabes and obsessives about military things. Realistically, you don't use it in normal conversation, particularly in places like HN, precisely to avoid confusion... unless one wants to signal that he's using it in the "intelligence" term, i.e. that one is a sad wannabe.

> That's the first time I've heard "open source" used to refer to a warez site.

I think "open-source intelligence" [0] is probably a little more commonly used but both terms basically refer to the same thing -- the acquiring and/or gathering of data or information from public, or "open", sources.

Originally, it was mostly a government/intelligence thing:

> Open-source intelligence (OSINT) is data collected from publicly available sources to be used in an intelligence context. In the intelligence community, the term "open" refers to overt, publicly available sources (as opposed to covert or clandestine sources).

More recently, it has been used to refer to the act of gathering information by searching the Internet.

> Is this overloading of the term being seeded by someone in order to, in a roundabout way, discredit the open source movement?

To be clear, this usage of "open-source" predates open-source software and "the open source movement" by a few decades, at least. Additionally, as the Wikipedia article explicitly points out (in the first paragraph), "it is not related to open-source software".

---

[0]: https://en.wikipedia.org/wiki/OSINT

Upvoting this comment (and its informative responses) because I was equally as confused by the wording in that phrase.

Reply on news.ycombinator.com